MmRemoveExecuteGrants

VOID __stdcall MmRemoveExecuteGrants(){
  _EPROCESS *Process; 
  char v1; 
  UINT64 v2; 
  INT64 v3[22]; 
  _MI_TB_FLUSH_LIST TbFlushList[48]; 

  memset(TbFlushList, 0i64, 0xB8u);
  memset(v3, 0i64, sizeof(v3));
  Process = KeGetCurrentThread()->ApcState.Process;
  LOWORD(v3[0]) = -32762;
  Process = (_EPROCESS *)((char *)Process + 1664);
  v3[3] = (INT64)Process;
  v3[21] = (INT64)TbFlushList;
  TbFlushList[0] = 1;
  v3[19] = (INT64)MiRevokeExecutePte;
  v3[20] = (INT64)HalSystemVectorDispatchEntry;
  v3[5] = 0xFFFF7FFFFFFFFFFFui64;
  LOWORD(TbFlushList[1]) = 0;
  *(_QWORD *)&TbFlushList[4] = 0i64;
  *(_QWORD *)&TbFlushList[6] = 0i64;
  TbFlushList[2] = 20;
  MiLockWorkingSetShared();
  BYTE6(v3[0]) = v1;
  MiWalkPageTables((INT64)v3);
  LOBYTE(v2) = BYTE6(v3[0]);
  MiUnlockWorkingSetShared((_MMSUPPORT_INSTANCE *)Process, v2);
  MiFlushTbList(TbFlushList);
}

Referenced by: